Daily

daily@lists.cert.at

1 participants
3150 discussions

Tageszusammenfassung - 26.01.2021
by Daily end-of-shift report 26 Jan '21

26 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Montag 25-01-2021 18:00 − Dienstag 26-01-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Fun with NMAP NSE Scripts and DOH (DNS over HTTPS), (Mon, Jan 25th) ∗∗∗ --------------------------------------------- DOH (DNS over HTTPS) has been implemented into the various browsers over the last year or so, and there's a fair amount of support for it on public DNS services. Because it's encrypted and over TCP, the mantra of "because privacy" has carried the day it looks like. But why do network and system admins hate it so? --------------------------------------------- https://isc.sans.edu/diary/rss/27026 ∗∗∗ Apache Software Foundation: Mehr Projekte und mehr Sicherheitswarnungen ∗∗∗ --------------------------------------------- Der Security Report 2020 der Apache Software Foundation zeigt einen Zuwachs an relevanten Sicherheitswarnungen für die Projekte unter dem Dach der Stiftung. --------------------------------------------- https://heise.de/-5035647 ∗∗∗ SMS „Wir konnten Ihr Paket nicht liefern“ ist Betrug ∗∗∗ --------------------------------------------- „Wir konnten Ihr Paket nicht liefern“ lautet eine SMS von InfoTrack. Über den angeführten Link gelangen Sie zu einer Aufforderung, 1 Euro für den Versand zu bezahlen. Doch Vorsicht: Bei dieser Benachrichtigung handelt es sich um eine Betrugsmasche. Wer diese Gebühr bezahlt, tappt in eine teure Abo-Falle. --------------------------------------------- https://www.watchlist-internet.at/news/sms-wir-konnten-ihr-paket-nicht-lief… ∗∗∗ New Variant of Ursnif Continuously Targeting Italy ∗∗∗ --------------------------------------------- Ursnif is a well-known banking Trojan with a large number of variants providing a diverse set of capabilities. A report from Fortinet analyzes a new variant of the malware specifically targeting users in Italy. --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/669b7072b9792bc67a9d430517e… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (dnsmasq, net-snmp, and xstream), Debian (mutt), Gentoo (cfitsio, f2fs-tools, freeradius, libvirt, mutt, ncurses, openjpeg, PEAR-Archive_Tar, and qtwebengine), openSUSE (chromium, mutt, stunnel, and virtualbox), Red Hat (cryptsetup, gnome-settings-daemon, and net-snmp), Scientific Linux (xstream), SUSE (postgresql, postgresql12, postgresql13 and rubygem-nokogiri), and Ubuntu (mutt). --------------------------------------------- https://lwn.net/Articles/844054/ ∗∗∗ Nagios Enterprises Nagios XI: Schwachstelle ermöglicht Codeausführung ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Nagios Enterprises Nagios XI ausnutzen, um beliebigen Programmcode auszuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0087 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.01.2021
by Daily end-of-shift report 25 Jan '21

25 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 22-01-2021 18:00 − Montag 25-01-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Security baseline for Microsoft Edge, version 88 ∗∗∗ --------------------------------------------- We are pleased to announce the enterprise-ready release of the security baseline for Microsoft Edge version 88! We have reviewed the settings in Microsoft Edge version 88 and updated our guidance with the addition of one setting that we will explain below. A new Microsoft Edge security baseline package was just released to the Download Center. You can download the version 88 package from the Security Compliance Toolkit. --------------------------------------------- https://techcommunity.microsoft.com/t5/microsoft-security-baselines/securit… ∗∗∗ Video: Doc & RTF Malicious Document, (Sun, Jan 24th) ∗∗∗ --------------------------------------------- I made a video for my diary entry "Doc & RTF Malicious Document". And I show a new feature of my tool re-search.py, that helps with filtering URLs found in OOXML files. --------------------------------------------- https://isc.sans.edu/diary/rss/27022 ∗∗∗ Scanning for Accessible MS-RDPEUDP services ∗∗∗ --------------------------------------------- We have started daily IPv4 /0 scanning for exposed MS-RDPEUDP instances on port 3389/UDP. Aside from the usual risks associated with exposing RDP services to the Internet, this UDP extension of the popular RDP services has been found to be susceptible to amplification DDoS abuse with an amplification factor of over 84. Over 12 000 instances of MS-RDPEUDP have been found to be accessible on the IPv4 Internet. --------------------------------------------- https://www.shadowserver.org/news/scanning-for-accessible-ms-rdpeudp-servic… ∗∗∗ RIFT: Analysing a Lazarus Shellcode Execution Method ∗∗∗ --------------------------------------------- After analysing the macro document, and pivoting on the macro, NCC Group’s RIFT identified a number of other similar documents. In these documents we came across an interesting technique being used to execute shellcode from VBA without the use of common “suspicious” APIs, such as VirtualAlloc, WriteProcessMemory or CreateThread – which may be detected by end point protection solutions. Instead, the macro documents abuse “benign” Windows API features toachieve code-execution. --------------------------------------------- https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode… ∗∗∗ Firewall-Hersteller SonicWall untersucht mögliche Zero-Day-Lücken in Produkten ∗∗∗ --------------------------------------------- Angreifer haben bislang unbekannte Lücken in SonicWall-Produkten ausgenutzt, um ins System des Herstellers einzudringen. --------------------------------------------- https://heise.de/-5033933 ∗∗∗ Von niedrig bis kritisch: Schwachstellenbewertung mit CVSS ∗∗∗ --------------------------------------------- Das Common Vulnerability Scoring System hilft bei der Bewertung von Schwachstellen. Wir erklären Funktionsweise und Grenzen des Systems. --------------------------------------------- https://heise.de/-5031983 ∗∗∗ DNSpooq: Wie sehr spukts in Österreich? ∗∗∗ --------------------------------------------- Am 2021-01-19 veröffentlichte JSOF eine Reihe von Schwachstellen in dnsmasq, einer populären DNS-Resolver Software für kleine Netzwerke. Ihr Blogpost dazu fasst diese Lücken unter dem Namen “DNSpooq" zusammen und beschreibt zwei mögliche Angriffsszenarien: ... --------------------------------------------- https://cert.at/de/aktuelles/2021/1/dnspooq-wie-sehr-spukts-in-osterreich ∗∗∗ Rückblick auf das letzte Drittel 2020 ∗∗∗ --------------------------------------------- Vorfälle und Aussendungen: ZeroLogon, Emotet, Microsoft Exchange CVE-2020-0688, Windows Server ohne Support, Ungepatchte Sophos Firewall XG Instanzen, SonicOS DoS und RCE, cit0day Leak, Ein Leak kommt selten allein, ... --------------------------------------------- https://cert.at/de/blog/2021/1/ruckblick-auf-das-letzte-drittel-2020 ===================== = Vulnerabilities = ===================== ∗∗∗ BlackBerry Powered by Android Security Bulletin - January 2021 ∗∗∗ --------------------------------------------- This advisory is in response to the Android Security Bulletin (January 2021) and addresses issues in that Security Bulletin that affect BlackBerry powered by Android smartphones. --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (crmsh, debian-security-support, flatpak, gst-plugins-bad1.0, openvswitch, python-bottle, salt, tomcat9, and vlc), Fedora (chromium, python-pillow, sddm, and xen), Gentoo (chromium, dnsmasq, flatpak, glibc, kdeconnect, openjdk, python, thunderbird, virtualbox, and wireshark), Mageia (blosc, crmsh, glibc, perl-DBI, php-oojs-oojs-ui, python-pip, python-urllib3, and undertow), openSUSE (gdk-pixbuf, hawk2, ImageMagick, opera, python-autobahn, viewvc, wavpack, xstream), Red Hat (dnsmasq), Slackware (seamonkey), SUSE (ImageMagick, hawk2, mutt, permissions, stunnel) and Ubuntu (pound). --------------------------------------------- https://lwn.net/Articles/843855/ ∗∗∗ Cisco DNA Center Cross-Site Request Forgery Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Synology-SA-21:01 DNSpooq ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_21_01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.01.2021
by Daily end-of-shift report 22 Jan '21

22 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 21-01-2021 18:00 − Freitag 22-01-2021 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Another File Extension to Block in your MTA: .jnlp, (Fri, Jan 22nd) ∗∗∗ --------------------------------------------- When hunting, one thing that I like to learn is how attackers can be imaginative at deploying new techniques. I spotted some emails that had suspicious attachments based on the .jnlp extension. --------------------------------------------- https://isc.sans.edu/diary/rss/27018 ∗∗∗ Magento PHP Injection Loads JavaScript Skimmer ∗∗∗ --------------------------------------------- A Magento website owner was concerned about malware and reached out to our team for assistance. Upon investigation, we found the website contained a PHP injection in one of the Magento files. --------------------------------------------- https://blog.sucuri.net/2021/01/magento-php-injection-loads-javascript-skim… ∗∗∗ Project Zero: Windows Exploitation Tricks: Trapping Virtual Memory Access ∗∗∗ --------------------------------------------- This blog is a continuation of my series of Windows exploitation tricks. This one describes an exploitation trick I’ve been trying to develop for years, succeeding (mostly, more on that later) on the latest versions of Windows 10. --------------------------------------------- https://googleprojectzero.blogspot.com/2021/01/windows-exploitation-tricks-… ∗∗∗ Crypto-Miner Dovecat hat es auf Netz-Speicher von Qnap und Synology abgesehen ∗∗∗ --------------------------------------------- Aktuelle Sicherheitshinweise sollen Netzwerkspeicher (NAS) von Qnap und Synology schützen. --------------------------------------------- https://heise.de/-5032679 ∗∗∗ New website launched to document vulnerabilities in malware strains ∗∗∗ --------------------------------------------- Launched by security researcher John Page, the new MalVuln website lists bugs in malware code. --------------------------------------------- https://www.zdnet.com/article/new-website-launched-to-document-vulnerabilit… ∗∗∗ A look at the NIS 2.0 Recitals ∗∗∗ --------------------------------------------- The EU commission dropped a large cyber security package on December 16th 2020, including a first draft for a new version of the NIS Directive. In front of the actual normative legal text, there are 84 recitals, describing the intents of the regulation. --------------------------------------------- https://cert.at/en/blog/2021/1/nis2-recitals-feedback ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple vulnerabilities in Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2 ∗∗∗ --------------------------------------------- Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2 provided by NEC Corporation contain multiple vulnerabilities. --------------------------------------------- https://jvn.jp/en/jp/JVN38248512/ ∗∗∗ Mehrere Schwachstellen in Selea CarPlateServern und Selea Targa IP OCR-ANPR Kameras ∗∗∗ --------------------------------------------- Zeroscience hat diverse Schwachstellen in zwei Produkten der Firma Selea gefunden. Bei beiden wurden unter anderem Möglichkeiten gefunden, fremden Code auszuführen. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ ∗∗∗ 0day in Windows 7 and Server 2008 R2 Gets a Micropatch ∗∗∗ --------------------------------------------- Update 1/22/2021: This vulnerability did not get patched by December 2020 or January 2021 Extended Security Updates, so we ported our micropatch to these updates. --------------------------------------------- https://blog.0patch.com/2020/11/0day-in-windows-7-and-server-2008-r2.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (drupal7), Fedora (dotnet3.1), Gentoo (zabbix), openSUSE (ImageMagick and python-autobahn), and SUSE (hawk2 and wavpack). --------------------------------------------- https://lwn.net/Articles/843571/ ∗∗∗ Windows RDP servers are being abused to amplify DDoS attacks ∗∗∗ --------------------------------------------- Windows RDP servers running on UDP port 3389 can be ensnared in DDoS botnets and abused to bounce and amplify junk traffic towards victim networks. --------------------------------------------- https://www.zdnet.com/article/windows-rdp-servers-are-being-abused-to-ampli… ∗∗∗ Delta Electronics ISPSoft ∗∗∗ --------------------------------------------- This advisory contains mitigations for a Use After Free vulnerability in Delta Electronics ISPSoft PLC program development tool. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-021-01 ∗∗∗ Delta Electronics TPEditor ∗∗∗ --------------------------------------------- This advisory contains mitigations for Untrusted Pointer Dereference, and Out-of-bounds Write vulnerabilities in Delta Electronics TPEditor programming software for Delta text panels. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-021-02 ∗∗∗ Honeywell OPC UA Tunneller ∗∗∗ --------------------------------------------- This advisory contains mitigations for Heap-based Buffer Overflow, Out-of-bounds Read, Improper Check for Unusual or Exceptional Conditions, and Uncontrolled Resource Consumption vulnerabilities in Honeywells OPC UA Tunneller software. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-021-03 ∗∗∗ Mitsubishi Electric MELFA ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Uncontrolled Resource Consumption vulnerability in Mitsubishi Electrics MELFA robot controllers. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-021-04 ∗∗∗ WAGO M&M Software fdtCONTAINER ∗∗∗ --------------------------------------------- This advisory contains mitigations for a Deserialization of Untrusted Data vulnerability in the M&M (a WAGO subsidiary) fdtCONTAINER application. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-021-05 ∗∗∗ Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-ja… ∗∗∗ Security Bulletin: IBM MQ Internet Pass-Thru is vulnerable to a denial of service attack (CVE-2020-4766) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-internet-pass-thru… ∗∗∗ Security Bulletin: A vulnerability in OpenSSL affects GCM16 & GCM32 KVM Switch Firmware (CVE-2019-1551) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-openss… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by multiple Mozilla Firefox vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: Security Vulnerability in IBM Java SDK affects IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerability-in… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.01.2021
by Daily end-of-shift report 21 Jan '21

21 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 20-01-2021 18:00 − Donnerstag 21-01-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop ∗∗∗ --------------------------------------------- One missing link in the complex Solorigate attack chain is the handover from the Solorigate DLL backdoor to the Cobalt Strike loader. How exactly does the jump from the Solorigate backdoor (SUNBURST) to the Cobalt Strike loader (TEARDROP, Raindrop, and others) happen? What code gets triggered, and what indicators should defenders look for? --------------------------------------------- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solor… ∗∗∗ Powershell Dropping a REvil Ransomware, (Thu, Jan 21st) ∗∗∗ --------------------------------------------- I spotted a piece of Powershell code that deserved some investigations because it makes use of RunSpaces. The file (SHA256:e1e19d637e6744fedb76a9008952e01ee6dabaecbc6ad2701dfac6aab149cecf) has a very low VT score: only 1/59!. --------------------------------------------- https://isc.sans.edu/diary/rss/27012 ∗∗∗ Scanning Activity Detected After Release of Exploit for Critical SAP SolMan Flaw ∗∗∗ --------------------------------------------- A Russian researcher has made public on GitHub a functional exploit targeting a critical vulnerability that SAP patched in its Solution Manager product in March 2020. --------------------------------------------- https://www.securityweek.com/scanning-activity-detected-after-release-explo… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (mutt), Fedora (libntlm, mingw-python-pillow, python-pillow, and sudo), Mageia (kernel), SUSE (gdk-pixbuf, perl-Convert-ASN1, samba, and yast2-multipath), and Ubuntu (linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.4, linux-hwe-5.8, linux-oracle). --------------------------------------------- https://lwn.net/Articles/843413/ ∗∗∗ Security Bulletin: Vulnerabilities in IBM WebSphere Liberty affects IBM Waston Machine Learning Accelerator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-we… ∗∗∗ Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-wo… ∗∗∗ Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are affected by vulnerabilities in Apache Xerces-C 3.0.0 to 3.2.2 XML parser (CVE-2018-1311) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: Vulnerabilities in IBM WebSphere Liberty affects IBM Waston Machine Learning Accelerator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-we… ∗∗∗ Security Bulletin: Vulnerability in gencore affects AIX (CVE-2020-4887) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-gencore-… ∗∗∗ Security Bulletin: Vulnerability in Apache Ant affects IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-a… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-10693) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: Vulnerability in Google Guava affects WebSphere Service Registry and Repository (CVE-2018-10237) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-google-g… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-4969) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: Rational Test Control Panel affected by Spring Framework vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-rational-test-control-pan… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-4958) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-4966) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ XSA-360 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-360.html ∗∗∗ Drupal: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0081 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.01.2021
by Daily end-of-shift report 20 Jan '21

20 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 19-01-2021 18:00 − Mittwoch 20-01-2021 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Qakbot activity resumes after holiday break, (Wed, Jan 20th) ∗∗∗ --------------------------------------------- It had been relatively quiet for Qakbot until Tuesday 2021-01-19, when we started seeing malicious spam (malspam) pushing Qakbot again. --------------------------------------------- https://isc.sans.edu/diary/rss/27008 ∗∗∗ Google Poject Zero: The State of State Machines ∗∗∗ --------------------------------------------- On January 29, 2019, a serious vulnerability was discovered in Group FaceTime. --------------------------------------------- https://googleprojectzero.blogspot.com/2021/01/the-state-of-state-machines.… ∗∗∗ Malwarebytes targeted by Nation State Actor implicated in SolarWinds breach. Evidence suggests abuse of privileged access to Microsoft Office 365 and Azure environments ∗∗∗ --------------------------------------------- A nation state attack leveraging software from SolarWinds has caused a ripple effect throughout the security industry, impacting multiple organizations. --------------------------------------------- https://blog.malwarebytes.com/malwarebytes-news/2021/01/malwarebytes-target… ∗∗∗ Abuse.ch URLhaus als neue Datenquelle für unsere Aussendungen aufgenommen ∗∗∗ --------------------------------------------- Seit Mittwoch, 13. Jänner 2020 senden wir die Daten der URLhaus Feeds des abuse.ch-Projekts in unseren regelmäßigen Benachrichtigungen an Netzbetreiber aus. Die Feeds umfassen URLs, die Malwaredateien diverser Schadsoftwarefamilien hosten. --------------------------------------------- https://cert.at/de/blog/2021/1/abusech-urlhaus-als-neue-datenquelle-fur-uns… ===================== = Vulnerabilities = ===================== ∗∗∗ Oracle Critical Patch Update Advisory - January 2021 ∗∗∗ --------------------------------------------- This Critical Patch Update contains 329 new security patches. --------------------------------------------- https://www.oracle.com/security-alerts/cpujan2021.html ∗∗∗ Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452 ∗∗∗ --------------------------------------------- In December 2020, FireEye uncovered and publicly disclosed a widespread attacker campaign that is being tracked as UNC2452. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2021/01/remediation-and-harden… ∗∗∗ Cisco Security Advisories 2021-01-20 ∗∗∗ --------------------------------------------- 4 Critical, 9 High, 18 Medium severity --------------------------------------------- https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&secur… ∗∗∗ Rechteausweitung: Kritische Lücke in älteren iOS- und macOS-Versionen ∗∗∗ --------------------------------------------- Der Bug in Apples XPC-Schnittstelle lässt sich ausnutzen, um erweiterte Rechte zu erlangen, warnt ein Sicherheitsforscher. --------------------------------------------- https://heise.de/-5030842 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (coturn, dovecot, glibc, and sudo), Mageia (openldap and resource-agents), openSUSE (dnsmasq, python-jupyter_notebook, viewvc, and vlc), Oracle (dnsmasq and xstream), SUSE (perl-Convert-ASN1, postgresql, postgresql13, and xstream), and Ubuntu (nvidia-graphics-drivers-418-server, nvidia-graphics-drivers-450-server, pillow, pyxdg, and thunderbird). --------------------------------------------- https://lwn.net/Articles/843255/ ∗∗∗ Two Vulnerabilities in Bosch Fire Monitoring System (FSM) ∗∗∗ --------------------------------------------- BOSCH-SA-332072-BT: Two vulnerabilties have been discovered affecting the Bosch Fire Monitoring System (FSM-2500 and FSM-5000). The critical issue applies to FSM systems with versions 5.2 and lower. --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-332072-bt.html ∗∗∗ Multiple Vulnerabilities in dnsmasq DNS Forwarder Affecting Cisco Products: January 2021 ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Advisory - Inconsistent Interpretation of HTTP Requests Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210120-… ∗∗∗ Security Advisory - Local Privilege Escalation Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210120-… ∗∗∗ Intel Ethernet 700 Series Controllers vulnerabilities CVE-2020-8690, CVE-2020-8691, CVE-2020-8692, and CVE-2020-8693 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K28563873 ∗∗∗ MISP: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0057 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.01.2021
by Daily end-of-shift report 19 Jan '21

19 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Montag 18-01-2021 18:00 − Dienstag 19-01-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Linux Devices Under Attack by New FreakOut Malware ∗∗∗ --------------------------------------------- The FreakOut malware is adding infected Linux devices to a botnet, in order to launch DDoS and cryptomining attacks. --------------------------------------------- https://threatpost.com/linux-attack-freakout-malware/163137/ ∗∗∗ Researchers Discover Raindrop — 4th Malware Linked to the SolarWinds Attack ∗∗∗ --------------------------------------------- Cybersecurity researchers have unearthed a fourth new malware strain—designed to spread the malware onto other computers in victims networks—which was deployed as part of the SolarWinds supply chain attack disclosed late last year. Dubbed "Raindrop" by Broadcom-owned Symantec, the malware joins the likes of other malicious implants such as Sunspot, Sunburst (or Solorigate), and Teardrop that were stealthily delivered to enterprise networks. --------------------------------------------- https://thehackernews.com/2021/01/researchers-discover-raindrop-4th.html ∗∗∗ Jetzt neues Passwort vergeben! OpenWrt-Forum gehackt ∗∗∗ --------------------------------------------- Angreifer konnten auf Nutzerdaten des OpenWrt-Forums zugreifen. Dort tauschen sich Nutzer des alternativen Betriebssystems u.a. für Router aus. --------------------------------------------- https://heise.de/-5028697 ∗∗∗ Three Word Passwords ∗∗∗ --------------------------------------------- The National Cyber Security Centre (NCSC) have advocated the use of three random words for several years to create strong passwords, and that advice has been repeated recently by the National Crime Agency, and multiple police forces in the UK…. but just how strong are these passwords? --------------------------------------------- https://www.pentestpartners.com/security-blog/three-word-passwords/ ∗∗∗ All That for a Coinminer? ∗∗∗ --------------------------------------------- A threat actor recently brute forced a local administrator password using RDP and then dumped credentials using Mimikatz. They not only dumped LogonPasswords but they also exported all Kerberos tickets ... --------------------------------------------- https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer/ ===================== = Vulnerabilities = ===================== ∗∗∗ DNSpooq: Mehrere Sicherheitslücken in Dnsmasq ∗∗∗ --------------------------------------------- Die IT-Sicherheitsfirma JSOF berichtet über mehrere Sicherheitslücken in der DNS-Serversoftware Dnsmasq, die sie DNSpooq genannt hat. Dabei handelt es sich um zwei zunächst völlig unterschiedliche Klassen von Problemen: Buffer Overflows in der Verarbeitung von DNSSEC-Records und einen unzureichenden Schutz vor DNS-Spoofing-Angriffen. ... Dnsmasq hat die entsprechenden Lücken in Version 2.83 geschlossen. Doch in vielen Fällen dürfte es schwer sein, Updates zu installieren. Dnsmasq wird sehr häufig in Embedded-Geräten und auch auf Android-Telefonen eingesetzt - also auf den Geräten, für die es häufig keine regelmäßigen Sicherheitsupdates gibt. Die Webseite von DNSpooq listet eine ganze Reihe von betroffenen Herstellern sowie deren Security-Advisories auf, die Liste dürfte aber unvollständig sein. --------------------------------------------- https://www.golem.de/news/dnspooq-mehrere-sicherheitsluecken-in-dnsmasq-210… ∗∗∗ Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities ∗∗∗ --------------------------------------------- Multiple vulnerabilities in the Universal Plug and Play (UPnP) service and the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow a remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has not released software updates that address these vulnerabilities. There are no workarounds --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gst-plugins-bad1.0), Fedora (flatpak), Red Hat (dnsmasq, kernel, kpatch-patch, libpq, linux-firmware, postgresql:10, postgresql:9.6, and thunderbird), SUSE (dnsmasq), and Ubuntu (dnsmasq, htmldoc, log4net, and pillow). --------------------------------------------- https://lwn.net/Articles/843142/ ∗∗∗ Atlassian Confluence: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Atlassian Confluence ausnutzen, um einen Denial of Service Angriff durchzuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0052 ∗∗∗ Philips Interventional Workstations ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-21-019-01 ∗∗∗ Reolink P2P Cameras ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-019-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.01.2021
by Daily end-of-shift report 18 Jan '21

18 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 15-01-2021 18:00 − Montag 18-01-2021 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Antivirus: Das Jahr der unsicheren Sicherheitssoftware ∗∗∗ --------------------------------------------- Sicherheitssoftware soll uns eigentlich schützen, doch das vergangene Jahr hat erneut gezeigt: Statt Schutz gibt es Sicherheitsprobleme frei Haus. --------------------------------------------- https://www.golem.de/news/antivirus-das-jahr-der-unsicheren-sicherheitssoft… ∗∗∗ Medical Device Security: Diagnosis Critical ∗∗∗ --------------------------------------------- Medical-device security has long been a challenge, suffering the same uphill management battle that the entire sprawling mess of IoT gadgets has faced. --------------------------------------------- https://threatpost.com/medical-device-security/163127/ ∗∗∗ Obfuscated DNS Queries, (Fri, Jan 15th) ∗∗∗ --------------------------------------------- This week I started seeing some URL with /dns-query?dns in my honeypot. The queries obviously did not look like a standard DNS queries, this got me curious and then proceeded to investigate to determine what these DNS query were trying to resolve. --------------------------------------------- https://isc.sans.edu/diary/rss/26992 ∗∗∗ New Release of Sysmon Adding Detection for Process Tampering, (Sun, Jan 17th) ∗∗∗ --------------------------------------------- Version 13.01 of Sysmon was released, a Windows Sysinternals tool to monitor and log system activity. --------------------------------------------- https://isc.sans.edu/diary/rss/26994 ∗∗∗ Doc & RTF Malicious Document, (Mon, Jan 18th) ∗∗∗ --------------------------------------------- A reader pointed us to a malicious Word document. --------------------------------------------- https://isc.sans.edu/diary/rss/26996 ∗∗∗ NSA Releases Guidance on Encrypted DNS in Enterprise Environments ∗∗∗ --------------------------------------------- Original release date: January 15, 2021The National Security Agency (NSA) has released an information sheet with guidance on adopting encrypted Domain Name System (DNS) over Hypertext Transfer Protocol over Transport Layer Security (HTTPS), referred to as DNS over HTTPS (DoH). When configured appropriately, strong enterprise DNS controls can help prevent many initial access, command and control, and exfiltration techniques used by threat actors. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/01/15/nsa-releases-guid… ∗∗∗ Skimming: Schaden durch Datenklau an Geldautomaten auf Rekordtief ∗∗∗ --------------------------------------------- Experten halten den Datenklau an Geldautomaten in Deutschland für ein Auslaufmodell. Sowohl Zahl der Angriffe als auch Schäden sanken 2020 auf Rekordtief. --------------------------------------------- https://heise.de/-5026975 ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-21-072: NETGEAR R7450 SOAP API RecoverAdminPassword Improper Access Control Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R7450 routers. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-072/ ∗∗∗ ZDI-21-071: NETGEAR R7450 Password Recovery External Control of Critical State Data Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 routers. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-071/ ∗∗∗ ZDI-21-070: Apple macOS CoreGraphics Image Parsing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-070/ ∗∗∗ ZDI-21-069: Apple macOS process_token_BlitLibSetup2D Out-Of-Bounds Write Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows local attackers to escalate privileges on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-069/ ∗∗∗ Kritische Admin-Lücke in Wordpress-Plug-in Orbit Fox ∗∗∗ --------------------------------------------- Es gibt ein wichtiges Sicherheitsupdate für das Wordpress-Plug-in Orbit Fox. --------------------------------------------- https://heise.de/-5027252 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (flatpak, ruby-redcarpet, and wavpack), Fedora (dia, mingw-openjpeg2, and openjpeg2), Mageia (awstats, bison, cairo, kernel, kernel-linus, krb5, nvidia-current, nvidia390, php, and thunderbird), openSUSE (cobbler, firefox, kernel, libzypp, zypper, nodejs10, nodejs12, and nodejs14), Scientific Linux (thunderbird), Slackware (wavpack), SUSE (kernel, nodejs8, open-iscsi, openldap2, php7, php72, php74, slurm_20_02, and thunderbird), and Ubuntu (ampache,[...] --------------------------------------------- https://lwn.net/Articles/842834/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (atftp, coturn, gitlab, mdbook, mediawiki, nodejs, nodejs-lts-dubnium, nodejs-lts-erbium, nodejs-lts-fermium, nvidia-utils, opensmtpd, php, python-cairosvg, python-pillow, thunderbird, vivaldi, and wavpack), CentOS (firefox and thunderbird), Debian (chromium and snapd), Fedora (chromium, flatpak, glibc, kernel, kernel-headers, nodejs, php, and python-cairosvg), Mageia (bind, caribou, chromium-browser-stable, dom4j, edk2, opensc, p11-kit,[...] --------------------------------------------- https://lwn.net/Articles/843054/ ∗∗∗ Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11 (CVE-2020-2590) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-ja… ∗∗∗ Security Bulletin: Websphere Hibernate Validator Vulnerability Affects IBM Control Center (CVE-2020-10693) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-hibernate-valid… ∗∗∗ Security Bulletin: IBM Integration Bus & IBM App Connect Enterprise are affected by a Websphere Application Server Vulnerability (CVE-2020-4576) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integration-bus-ibm-a… ∗∗∗ Security Bulletin: Apache ActiveMQ Vulnerability Affects IBM Control Center (CVE-2020-13920) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-activemq-vulnerabi… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.01.2021
by Daily end-of-shift report 15 Jan '21

15 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 14-01-2021 18:00 − Freitag 15-01-2021 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ ErpresserInnen kennen Ihre persönlichen Daten? Nicht einschüchtern lassen! ∗∗∗ --------------------------------------------- Immer wieder werden uns erpresserische E-Mails gemeldet, in denen persönliche Daten der Betroffenen genannt werden. Aktuell ist eine Erpressungsmail im Umlauf, in der die Kriminellen vorgeben einiges über die EmpfängerInnen zu wissen. Als Beweis geben sie die Adresse und die Telefonnummer an. Auch wenn dieses Wissen verunsichert, sollten Sie sich nicht einschüchtern lassen und die Forderungen der ErpresserInnen ignorieren. --------------------------------------------- https://www.watchlist-internet.at/news/erpresserinnen-kennen-ihre-persoenli… ∗∗∗ Hunting for Bugs in Windows Mini-Filter Drivers ∗∗∗ --------------------------------------------- In December Microsoft fixed 4 issues in Windows in the Cloud Filter and Windows Overlay Filter (WOF) drivers (CVE-2020-17103, CVE-2020-17134, CVE-2020-17136, CVE-2020-17139). These 4 issues were 3 local privilege escalations and a security feature bypass, and they were all present in Windows file system filter drivers. I’ve found a number of issues in filter drivers previously, including 6 in the LUAFV driver which implements UAC file virtualization. --------------------------------------------- https://googleprojectzero.blogspot.com/2021/01/hunting-for-bugs-in-windows-… ∗∗∗ Cyber Security advice for Finance staff ∗∗∗ --------------------------------------------- Working in the finance team at PTP I’m constantly reminded just how little attention is paid to hacking and cyber crime in accounting and finance training and education. When I [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/cyber-security-advice-for-fin… ∗∗∗ Throwback Friday: An Example of Rig Exploit Kit, (Fri, Jan 15th) ∗∗∗ --------------------------------------------- https://isc.sans.edu/diary/rss/26990 ===================== = Vulnerabilities = ===================== ∗∗∗ Netlogon Domain Controller Enforcement Mode is enabled by default beginning with the February 9, 2021 Security Update, related to CVE-2020-1472 ∗∗∗ --------------------------------------------- Microsoft addressed a Critical RCE vulnerability affecting the Netlogon protocol (CVE-2020-1472) on August 11, 2020. We are reminding our customers that beginning with the February 9, 2021 Security Update release we will be enabling Domain Controller enforcement mode by default. This will block vulnerable connections from non-compliant devices. DC enforcement mode requires that all Windows and non-Windows devices use secure RPC with Netlogon secure channel unless customers have explicitly [...] --------------------------------------------- https://msrc-blog.microsoft.com:443/2021/01/14/netlogon-domain-controller-e… ∗∗∗ Apache Releases Security Advisory for Tomcat ∗∗∗ --------------------------------------------- The Apache Software Foundation has released a security advisory to address a vulnerability affecting multiple versions of Apache Tomcat. An attacker could exploit this vulnerability to obtain sensitive information. CISA encourages users and administrators to review the Apache security advisory for CVE-2021-24122 and upgrade to the appropriate version. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/01/15/apache-releases-s… ∗∗∗ ZDI-21-068: Panasonic Control FPWIN Pro Project File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Panasonic Control FPWIN Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-068/ ∗∗∗ Mitsubishi Electric Factory Automation Products Path Traversal (Update A) ∗∗∗ --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-20-212-03 Mitsubishi Electric Factory Automation Products Path Traversal that was published July 30, 2020, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for a Path Traversal vulnerability in Mitsubishi Electric Factory Automation products. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-212-03 ∗∗∗ Mitsubishi Electric Factory Automation Engineering Products (Update B) ∗∗∗ --------------------------------------------- This updated advisory is a follow-up to the advisory update titled ICSA-20-212-04 Mitsubishi Electric Factory Automation Engineering Products (Update A) that was published November 5, 2020, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for an Unquoted Search Path or Element vulnerability in Mitsubishi Electric Factory Automation Engineering products. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-212-04 ∗∗∗ Security Bulletin: Vulnerability in Apache Solr affecting Watson Knowledge Catalog for IBM Cloud Pak for Data ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-s… ∗∗∗ Security Bulletin: Malicious file upload and download could affect Watson Knowledge Catalog for IBM Cloud Pak for Data ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-malicious-file-upload-and… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in Java affecting Watson Knowledge Catalog for IBM Cloud Pak for Data ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Cross Site Scripting vulnerability in Google Web Toolkit may affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2012-5920 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.01.2021
by Daily end-of-shift report 14 Jan '21

14 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 13-01-2021 18:00 − Donnerstag 14-01-2021 18:00 Handler: Thomas Pribitzer Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ Big Sur: Apple erlaubt wieder Firewall-Filter für Systemdienste ∗∗∗ --------------------------------------------- In aktuellen MacOS-Versionen hatte Apple seine Systemdienste von Firewall-Regeln ausgenommen. Eine Betaversion macht das nun rückgängig. --------------------------------------------- https://www.golem.de/news/big-sur-apple-erlaubt-wieder-firewall-filter-fuer… ∗∗∗ Sysdig beobachtet einen Shift Left bei Container Security ∗∗∗ --------------------------------------------- Während Docker als Container Runtime an Bedeutung verliert, scannen immer mehr Anwender ihre Images schon früh im Build-Prozess ihrer CI/CD-Pipelines. --------------------------------------------- https://heise.de/-5024624 ∗∗∗ Cisco says it wont patch 74 security bugs in older RV routers that reached EOL ∗∗∗ --------------------------------------------- Cisco advises RV110W, RV130, RV130W, and RV215W device owners to migrate to newer gear. --------------------------------------------- https://www.zdnet.com/article/cisco-says-it-wont-patch-74-security-bugs-in-… ∗∗∗ Telegram-based phishing service Classiscam hits European marketplaces ∗∗∗ --------------------------------------------- Dozens of cybercriminal gangs are publishing fake ads on popular online marketplaces to lure interested users to fraudulent merchant sites or to phishing pages that steal payment data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/telegram-based-phishing-serv… ∗∗∗ Windows 10 bug corrupts your hard drive on seeing this files icon ∗∗∗ --------------------------------------------- An unpatched zero-day in Microsoft Windows 10 allows attackers to corrupt an NTFS-formatted hard drive with a one-line command. --------------------------------------------- https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your… ∗∗∗ Dynamically analyzing a heavily obfuscated Excel 4 macro malicious file, (Thu, Jan 14th) ∗∗∗ --------------------------------------------- Recently I had to analyze an Excel malicious file that was caught in the wild, in a real attack. The file was used in a spear phishing attack where a victim was enticed into opening the file with Excel and, of course, enabling macros. --------------------------------------------- https://isc.sans.edu/diary/rss/26986 ∗∗∗ Attackers Exploit Poor Cyber Hygiene to Compromise Cloud Security Environments ∗∗∗ --------------------------------------------- CISA is aware of several recent successful cyberattacks against various organizations’ cloud services. Threat actors used a variety of tactics and techniques, including phishing and brute force logins, to attempt to exploit weaknesses in cloud security practices. In response, CISA has released Analysis Report AR21-013A: Strengthening Security Configurations to Defend Against Attackers Targeting Cloud Services which provides technical details and [...] --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/01/13/attackers-exploit… ∗∗∗ Opening “STEELCORGI”: A Sophisticated APT Swiss Army Knife ∗∗∗ --------------------------------------------- This time we decided to dissect and share intelligence information about another piece of the TH-239 arsenal: a tiny and mysterious tool dubbed “STEELCORGI” on FireEye research. This tool was heavily protected using a novel technique able to make things really difficult to any DFIR Team tackling with TH-239 intrusion, but it’s contents reveal huge surprises and unattended capabilities. --------------------------------------------- https://yoroi.company/research/opening-steelcorgi-a-sophisticated-apt-swiss… ∗∗∗ A Global Perspective of the SideWinder APT ∗∗∗ --------------------------------------------- AT&T Alien Labs has conducted an investigation on the adversary group publicly known as SideWinder in order to historically document its highly active campaigns and identify a more complete picture of targets, motivations, and objectives. --------------------------------------------- https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-t… ===================== = Vulnerabilities = ===================== ∗∗∗ Office January security updates fix remote code execution bugs ∗∗∗ --------------------------------------------- Microsoft addresses important severity remote code execution vulnerabilities affecting multiple Office products in the January 2021 Office security updates released during this months Patch Tuesday. --------------------------------------------- https://www.bleepingcomputer.com/news/security/office-january-security-upda… ∗∗∗ Juniper Networks Releases Security Updates for Multiple Products ∗∗∗ --------------------------------------------- Juniper Networks has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to cause take control of an affected system. CISA encourages users and administrators to review the Juniper Networks security advisories page and apply the necessary updates. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/01/14/juniper-networks-… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (adplug, audacious-plugins, cpu-x, kernel, kernel-headers, ocp, php, and python-lxml), openSUSE (crmsh, firefox, and hawk2), Oracle (thunderbird), Red Hat (kernel-rt), SUSE (kernel and rubygem-archive-tar-minitar), and Ubuntu (openvswitch and tar). --------------------------------------------- https://lwn.net/Articles/842673/ ∗∗∗ Pepperl+Fuchs IO-Link Master Series 1.36 CSRF / XSS / Command Injection ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2021010110 ∗∗∗ OpenSSL vulnerability CVE-2020-1971 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K42910051 ∗∗∗ Red Hat Decision Manager: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0037 ∗∗∗ Security Advisory - Denial of Service Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210113-… ∗∗∗ Security Advisory - Insufficient Integrity Check Vulnerability in Huawei Sound X Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210113-… ∗∗∗ Security Advisory - Logic Vulnerability in Huawei Gauss100 Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210113-… ∗∗∗ Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft File Systems Agent (CVE-2020-26116) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-python-a… ∗∗∗ Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-ins… ∗∗∗ Security Bulletin: Security Vulnerabilities in GNU glibc affect IBM Cloud Pak for Data – GNU glibc (CVE-2020-1751) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-privileged-i… ∗∗∗ Security Bulletin: PostgreSQL Vulnerability Affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2020-25696) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-postgresql-vulnerability-… ∗∗∗ Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-privileged-i… ∗∗∗ Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-privileged-i… ∗∗∗ Security Bulletin: A vulnerability in Spring Framework affects IBM Tivoli Application Dependency Discovery Manager (CVE-2020-5421). ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-spring… ∗∗∗ Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise and IBM Integration Bus (CVE-2020-7769) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-node-j… ∗∗∗ Security Bulletin: A vulnerability was identified and remediated in the IBM MaaS360 Cloud Extender (CVE-2020-15358) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-was-ident… ∗∗∗ Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-privileged-i… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities (CVE-2015-9381, CVE-2015-9382) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition, that is used by IBM Workload Scheduler. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM MaaS360 Mobile Enterprise Gateway has security vulnerabilities (CVE-2019-2044, CVE-2019-2045) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maas360-mobile-enterp… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2019-11745) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM API Connect V5 Developer Portal is vulnerable to cross-site scripting (CVE-2020-4838) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-v5-develo… ∗∗∗ Security Bulletin: CVE-2020-2601 may affect IBM® SDK, Java™ Technology Edition, that is used by IBM Workload Scheduler. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-2601-may-affect-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.01.2021
by Daily end-of-shift report 13 Jan '21

13 Jan '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 12-01-2021 18:00 − Mittwoch 13-01-2021 18:00 Handler: Thomas Pribitzer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Hackers steal Mimecast certificate used to encrypt customers’ M365 traffic ∗∗∗ --------------------------------------------- Compromise by "sophisticated threat actor" prompts company to issue new certificate. --------------------------------------------- https://arstechnica.com/?p=1734653 ∗∗∗ MegaCortex Ransomware: The Cyber-Threat Looming Over Corporate Networks ∗∗∗ --------------------------------------------- Cybercriminals only want one thing these days, and that thing is substantial payouts. This is why most hackers focus on big game hunting, directing the vast majority of their efforts towards company networks rather than individual home users. --------------------------------------------- https://heimdalsecurity.com/blog/megacortex-ransomware/ ∗∗∗ Hancitor activity resumes after a hoilday break, (Wed, Jan 13th) ∗∗∗ --------------------------------------------- Campaigns spreading Hancitor malware were active from October through December 2020, but Hancitor went quiet after 2020-12-17. On Tuesday 2021-01-12, criminals started sending malicious spam (malspam) pushing Hancitor again. --------------------------------------------- https://isc.sans.edu/diary/rss/26980 ∗∗∗ Obfuscation Techniques in Ransomweb “Ransomware” ∗∗∗ --------------------------------------------- As vital assets for many business operations, websites and their hosting servers are often the target of ransomware attacks — and if they get taken offline, this can cause major issues for a business’ data, revenue, and ultimately reputation. --------------------------------------------- https://blog.sucuri.net/2021/01/obfuscation-techniques-in-ransomweb-ransomw… ∗∗∗ A Rare Look Inside a Cryptojacking Campaign and its Profit ∗∗∗ --------------------------------------------- This post details an ongoing cryptojacking campaign targeting Linux machines, using exposed Docker API ports as an initial access vector to a victim’s machine. The attacker then installs a Golang binary, which is undetected in VirusTotal at the time of this writing. --------------------------------------------- https://www.intezer.com/blog/research/a-rare-look-inside-a-cryptojacking-ca… ∗∗∗ Ubiquiti breach, and other IoT security problems ∗∗∗ --------------------------------------------- Ubiquiti informed its customers about unauthorized access to its online customer portal. Heres what you need to know. --------------------------------------------- https://blog.malwarebytes.com/iot/2021/01/ubiquiti-breach-and-other-iot-sec… ∗∗∗ Rogue Android RAT Can Take Control of Devices, Steal Data ∗∗∗ --------------------------------------------- A recently discovered Mobile Remote Access Trojan (MRAT) can take control of the infected Android devices and exfiltrate a trove of user data, Check Point security researchers warn. --------------------------------------------- https://www.securityweek.com/rogue-android-rat-can-take-control-devices-ste… ∗∗∗ Google reveals sophisticated Windows and Android hacking operation ∗∗∗ --------------------------------------------- The attackers used a combination of Android, Chrome, and Windows vulnerabilities, including both zero-days and n-days exploits. --------------------------------------------- https://www.zdnet.com/article/google-reveals-sophisticated-windows-android-… ∗∗∗ Vorsicht vor gefälschten Rechnungen von Austria IT, Vicca Security & Online Service Support ∗∗∗ --------------------------------------------- Derzeit werden uns gehäuft betrügerische E-Mails mit gefälschten Rechnungen von „Austria IT“, „Vicca Security“ und „Online Service Support“ gemeldet. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschten-rechnungen… ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft January 2021 Patch Tuesday fixes 83 flaws, 1 zero-day ∗∗∗ --------------------------------------------- With the January 2021 Patch Tuesday security updates release, Microsoft has released fixes for 83 vulnerabilities, with ten classified as Critical and 73 as Important. There is also one zero-day and one previously disclosed vulnerabilities fixed as part of the January 2021 updates. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2021-patc… ∗∗∗ Microsoft fixes Secure Boot bug allowing Windows rootkit installation ∗∗∗ --------------------------------------------- Microsoft has fixed a security feature bypass vulnerability in Secure Boot that allows attackers to compromise the operating systems booting process even when Secure Boot is enabled. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-fixes-secure-boot-… ∗∗∗ Cisco Security Advisories 2021-01-13 ∗∗∗ --------------------------------------------- 0 Critical, 4 High, 19 Medium severity --------------------------------------------- https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&secur… ∗∗∗ Sicherheitsupdate: Kritische Schadcode-Lücke in Thunderbird ∗∗∗ --------------------------------------------- Mozilla hat seinen Mail-Client abgesichert. Nutzer sollten schnell updaten. --------------------------------------------- https://heise.de/-5022816 ∗∗∗ Multiple Vulnerabilities Patched in Orbit Fox by ThemeIsle Plugin ∗∗∗ --------------------------------------------- On November 19, 2020, our Threat Intelligence team responsibly disclosed two vulnerabilities in Orbit Fox by ThemeIsle, a WordPress plugin used by over 400,000 sites. --------------------------------------------- https://www.wordfence.com/blog/2021/01/multiple-vulnerabilities-patched-in-… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (coturn, imagemagick, and spice-vdagent), Fedora (roundcubemail and sympa), Gentoo (asterisk and virtualbox), Oracle (kernel and kernel-container), Red Hat (dotnet3.1, dotnet5.0, and thunderbird), SUSE (crmsh, firefox, hawk2, ImageMagick, kernel, libzypp, zypper, nodejs10, nodejs14, openstack-dashboard, release-notes-suse-openstack-cloud, and tcmu-runner), and Ubuntu (coturn). --------------------------------------------- https://lwn.net/Articles/842557/ ∗∗∗ The installer of SKYSEA Client View may insecurely load Dynamic Link Libraries ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN69635538/ ∗∗∗ Security Bulletin: CVE-2020-1968 vulnerability in OpenSSL may affect IBM Workload Scheduler ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-1968-vulnerabili… ∗∗∗ Local Privilege Escalation in VMware vRealize Automation (vRA) Guest Agent Service ∗∗∗ --------------------------------------------- https://medium.com/@bridge_004/local-privilege-escalation-in-vmware-vrealiz… ∗∗∗ SOOIL Dana Diabecare RS Products ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-21-012-01 ∗∗∗ Schneider Electric EcoStruxure Power Build-Rapsody ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily